ASK MAT – What does effectiveness scoring mean in my BRA/EWRA?

ASK MAT – What does effectiveness scoring mean in my BRA/EWRA?

• I am refreshing our Jersey BRA / EWRA, and the model now includes an “effectiveness score”. The JFSC Compliance Monitoring guidance (last revised 4 June 2026) discusses inherent risk, residual risk, and testing whether controls are operating effectively.

• What does effectiveness scoring actually mean – and what will the JFSC expect to see?

MAT SAYS: Thank you for an excellent question.

Two uncomfortable truths.

• THE JFSC DOES NOT PRESCRIBE AN “EFFECTIVENESS SCORE”.

  • No 1–5 scale.

  • No approved formula.

  • No official EWRA schema.

• AND THE HANDBOOK BRA IS NOT AN ALL-RISKS EWRA.

  • The BRA is AML/CTF/CPF.

  • Principle 3 is all risks as a business enterprise.

  • The 2026 CMP guidance EWRA sits over both.

What the JFSC does require, in each assessment, is this chain:

• Inherent risk →

• controls assessed for efficacy and adherence →

• residual risk →

• risk-based testing →

• Updated residual versus appetite.

Warning:

• Score effectiveness once and apply it to both, and you will fail one of them.

• Do not treat “we have a policy” as “the control is effective”. That is the mistake they keep finding

THE LABELS LADDER – DO NOT CONFLATE THESE

1. AML/CTF/CPF BRA

   • Hook = Handbook COP1 / the Money Laundering (Jersey) Order

   • Scope = ML/TF/PF “in the round” (structure, customers, countries, products, delivery)

   • Residual = financial crime residual versus FC appetite

   • Score the FC controls (CDD, screening, monitoring, SARs, training)

2. PRINCIPLE 3 ENTERPRISE RISK ASSESSMENT

   • Hook = sector Codes, Principle 3 (including 3.1.3.1)

   • Scope = all the risks the firm faces, or may face, as a business enterprise

   • Residual = enterprise residual versus enterprise appetite

   • Score ops, conduct, prudential, cyber, sustainability and financial crime

3. CMP RISK ASSESSMENT / EWRA (2026 guidance type)

   • Hook = guidance, not a new Code

   • Purpose = a firm-wide inherent/residual view used to aim the CMP

   • Paragraph 3.13 = cover operational, regulatory and financial crime

   • Test the highest residual, after effectiveness – not after a policy inventory

Warning: The 2026 note lists EWRA as one type of assessment.

• The same table still points to that row at AML/CFT/CPF.

• That is untidy drafting. It does not repeal COP1, it does not turn the BRA into an all-risks EWRA, and it does not let you exclude financial crime from the EWRA because “FC lives in the BRA”.

• A CDD control scored effective in the BRA does not automatically score effective for a Principle 3 conduct or operational risk.

THE EFFECTIVENESS LADDER – DO NOT SKIP A RUNG

1. DESIGN / EFFICACY

   • Are the systems and controls capable of producing the intended outcome?

   • Handbook 2.4.1: efficacy = “capacity to have the desired outcome”

2. OPERATING EFFECTIVENESS / ADHERENCE

   • Are they complied with in practice?

   • COP5 / COP11: assess effectiveness and compliance, and test that controls are followed

   • Article 11(11) MLO: monitor compliance with and test the effectiveness of policies, awareness and training

3. RESIDUAL

   • What remains after effectiveness, not after a control inventory?

   • Re-score impact and/or likelihood. Compared to the relevant appetite

   • 2022 BRA feedback: map the effect of controls onto inherent risk, or you cannot defend residual

   • Best practice: score whether the control reduces likelihood, impact, or both – and use CMP / audit findings as the evidence

Good practice (2026):

• RAG or a numerical rating for transparency.

Poor practice (2013 and 2026):

• Assuming controls exist, the residual is low; “negative assurance” (no breaches ⇒ effective).

WHAT MUST MOVE THE SCORE

• CMP results, breaches, incidents, complaints, exam feedback, audit, and trigger events, not just the annual ritual.

• The question from the 2023–24 financial crime exams still stands:

Do the results from your CMP testing inform the control assessments in your BRA?

• Ask it again for Principle 3. If the answer is no, residual is fiction.

• Do not use CMP completion rate as the score. Tests completed ≠ controls effective.

• Do not import a group template as the Jersey BRA.

• Do not take high inherent risk to green on an untested key control.

MAT’S BOTTOM LINE

• Effectiveness scoring is the evidenced judgement that a control can produce the desired outcome and is operating as intended – so residual is honestly within appetite.

• Do that twice where you must:

  • In the AML/CTF/CPF BRA and

  • In the Principle 3 enterprise view.

• Use the 2026 EWRA type to aim testing, not as a third competing assessment and not as a synonym for the Handbook BRA.

• Residual is calculated on performance, not paper.

• If the score cannot show which obligation set it answers, which parameter it moved (likelihood/impact/both), what test moved it, and what happens if the next test fails, then it is not an effectiveness score. It is a comfort rating.

SOURCES

• JFSC Guidance Note: Compliance Monitoring (6 December 2013; last revised 4 June 2026) – 2.5, 3.3, 3.13–3.15 https://www.jerseyfsc.org/industry/guidance-and-policy/compliance-monitoring/ https://www.jerseyfsc.org/media/ekynybkh/gn-compliance-monitoring.pdf

• AML/CFT/CPF Handbook – COP1 (BRA is ML/TF/PF “in the round”); COP5 / COP11 / 2.4.1 https://www.jerseyfsc.org/industry/financial-crime/amlcftcpf-handbooks/amlcftcpf-handbook/ https://www.jerseyfsc.org/media/cdddbc5l/handbook-effective-as-at-30-june-2026.pdf

• 2022 AML/CFT BRA and Strategy Feedback https://www.jerseyfsc.org/industry/examinations/2022-amlcft-business-risk-assessment-and-formal-amlcft-strategy-feedback

• Investment Business Code, Principle 3 (Note 1: all risks as a business enterprise; 3.1.3.1) https://www.jerseyfsc.org/industry/codes-of-practice/investment-business-code-of-practice

• 2024 CMP Examination Feedback (issued 17 June 2025) https://www.jerseyfsc.org/industry/examinations/examination-findings-and-questionnaires/2024-compliance-monitoring-examination-feedback https://www.jerseyfsc.org/media/z0lhknou/compliance-monitoring-examination-feedback.pdf

• Financial crime examination feedback 2023–2024 https://www.jerseyfsc.org/media/l04nx0uc/financial-crime-examination-feedback-2023-2024.pdf

Mathew Beale – Chartered FCSI Principal & Director – Comsure Compliance Limited, Comsure Technology Limited, Comsure Mauritius mathew@comsuregroup.com www.comsuregroup.com Direct Tel: +44 (0) 1534 626841 Mobile Tel: +44 (0) 7797 747490

ASK MAT | JERSEY | BRA | EWRA | CMP | PRINCIPLE 3 | JFSC | EFFECTIVENESS